Kenya looks into the hacking of Ruto's official website following a bitcoin ransom request.

      Kenyan authorities are looking into a cyberattack that altered President William Ruto’s official website over the weekend, substituting the homepage with a ransom note and a cryptocurrency wallet address. The government took the president.go.ke site offline on Saturday and has since stated that there is no indication that sensitive data was compromised.

      The attackers demanded five bitcoins, approximately worth 41 million Kenyan shillings (about $317,000), threatening to release material if the payment was not made by that evening, as reported by Kenyan media that accessed the page before it was removed. The message, directed at Ruto, claimed it was the third warning issued.

      The defaced homepage, first identified shortly after 2 pm on Saturday, included offensive language and unspecified accusations against the president, along with the wallet address. At that time, the usual presidential content of speeches and press releases had been erased from the site.

      William Kabogo, the cabinet secretary for information, communications, and the digital economy, confirmed the breach on Saturday, stating that access to the site had been “temporarily restricted to facilitate containment, forensic analysis, and restoration efforts.” He also mentioned that there was “no evidence of unauthorized access to sensitive data, data exfiltration, or information loss.”

      The National Computer and Cybercrime Coordination Committee (NC4) was activated to direct the response, collaborating with State House technical teams and external partners. Kabogo assured that government systems and digital services “remain secure and operational,” and the site was restored by Sunday, with speeches, press releases, and communications preserved.

      No group has taken responsibility for the attack, and officials have not disclosed how the intruders gained access or whether they view the ransom demand as more than opportunistic. The identities of those behind the defacement are still unknown, and the government has not specified when its forensic review will be completed.

      The timing is challenging for an administration that has spent two years dealing with both street protests and cyber intrusions. Ruto’s government has encountered ongoing demonstrations led by Gen Z over issues like taxation, living costs, and police conduct, with protests occurring as much on digital platforms as in the streets of Nairobi.

      The nation’s online infrastructure has faced repeated scrutiny during this time, and the defacement of the president's website carries a symbolic significance that the government acted promptly to address. Officials took swift action to restrict access and framed the situation as managed rather than disastrous.

      Earlier in 2023, the hacktivist group Anonymous Sudan disrupted the eCitizen portal that Kenyans use for various government services in a DDoS campaign, briefly affecting functions such as passport applications and mobile-money transfers. The then-ICT secretary, Eliud Owalo, acknowledged the attack but assured that no data had been compromised, a reassurance reiterated this week.

      In 2025, a larger assault affected multiple state websites simultaneously, including those of State House and several ministries. Government platforms have consistently been targets, with website defacements and ransomware being among the most frequently utilized tactics against them.

      National statistics show a concerning trend, with analysts noting billions of attempted cyber intrusions in a recent three-month period, with Nairobi having the highest incidence of reported cybercrime, ranging from unauthorized access to identity theft.

      Kenya has established itself as a leading digital economy on the continent, with Nairobi promoted as East Africa’s tech hub. The government has recently approved a National Cybersecurity Agency Order aimed at centralizing policy and incident response, a framework now facing an early evaluation due to the defaced presidential homepage.

      Officials argue that the rapid restoration of the site is a measure of whether their investment in cybersecurity is yielding benefits. However, it is unclear whether the ransom was a genuine expectation or if the intent was merely to humiliate the president on his own website, as investigators have not clarified this aspect.